{"id":92390,"date":"2020-08-26T19:42:10","date_gmt":"2020-08-26T17:42:10","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/kak-my-postroili-virtualnuyu-infrastrukturu-dlya-kiberuchenij-promyshlennyh-predpriyatij"},"modified":"2020-08-26T19:42:10","modified_gmt":"2020-08-26T17:42:10","slug":"kak-my-postroili-virtualnuyu-infrastrukturu-dlya-kiberuchenij-promyshlennyh-predpriyatij","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/kak-my-postroili-virtualnuyu-infrastrukturu-dlya-kiberuchenij-promyshlennyh-predpriyatij","title":{"rendered":"How we built a virtual infrastructure for cyber exercises of industrial enterprises","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"How
\n
\nThis year we started a large project to create a cyber polygon \u2013 a platform for cyber training for companies in various industries. To do this, we need to create virtual infrastructures that are \"identical to the real thing\" \u2014 to replicate the typical internal structure of a bank, energy company, etc., not only in terms of the corporate segment of the network. We will share more about the banking and other infrastructures of the cyber polygon later, but today we'll discuss how we approached this task in relation to the technological segment of an industrial enterprise.
\n<\/a><\/noindex>
\nOf course, the topic of cyber training and cyber polygons didn't just emerge yesterday. In the West, there has long been a range of competing offers, various approaches to cyber training, as well as simply best practices. A \"good practice\" for cybersecurity services is to periodically drill their readiness to fend off cyber attacks in real scenarios. For Russia, however, this is still a new topic: yes, there has been some modest offering that emerged a few years ago, but demand, particularly in industrial sectors, has only just begun to grow. We believe there are three main reasons for this \u2014 which are also issues that have become quite evident.<\/p>\n

The world is changing too quickly<\/b><\/p>\n

Ten years ago, hackers mainly targeted organizations from which they could quickly extract money. This threat was less relevant to the industrial sector. Today, we see that state organizations, energy, and industrial enterprises have also become their focus. Here, we often deal with attempts at espionage, data theft for various purposes (competitive intelligence, blackmail), as well as gaining footholds within infrastructure for further sale to interested parties. Even simple ransomware like WannaCry has affected many such targets around the world. Therefore, current realities require cybersecurity specialists to consider these risks and establish new information security processes. In particular, they should regularly improve their qualifications and focus on practical skills. Personnel at all levels of operational dispatching management for industrial facilities must have a clear understanding of what actions to take in the event of a cyberattack. However, conducting cyber exercises on one's own infrastructure\u2014forget it, the risks clearly outweigh any potential benefits. <\/p>\n

Misunderstanding the actual capabilities of attackers in breaching SCADA and IIoT systems<\/b><\/p>\n

This problem exists at all organizational levels: not all specialists even understand what could happen to their systems and what attack vectors exist against them. Just imagine the level of understanding among management.<\/p>\n

Security professionals often refer to the 'air gap', which supposedly prevents attackers from going beyond the corporate network, but practice shows that in 90% of organizations, there is a connection between the corporate and technological segments. Moreover, the very elements involved in building and managing technological networks often have vulnerabilities, as we specifically discovered while examining the equipment. MOXA<\/a><\/noindex> and Schneider Electric<\/a><\/noindex>.<\/p>\n

It is difficult to build an adequate threat model<\/b><\/p>\n

In recent years, there has been a constant trend towards the increasing complexity of information and automated systems, as well as a shift to cyber-physical systems that integrate computing resources with physical equipment. The systems have become so complex that it is impossible to predict all the consequences of cyberattacks using analytical methods. This is not only about the economic damage to an organization but also about evaluating the consequences that are understandable to technologists and the industry \u2013 such as shortages of electricity or other types of products, especially in the oil and gas or petrochemical sectors. How do we prioritize in such a situation? <\/p>\n

In fact, this has led to the emergence of the concepts of cyber exercises and cyber polygons in Russia. <\/p>\n

How the technological segment of cyber polygons is structured<\/h3>\n

\nA cyber polygon is a complex of virtual infrastructures that replicate typical infrastructures of enterprises from various industries. It allows professionals to \"practice on cats\" \u2013 to develop practical skills without the risks of something going wrong and causing damage to the operations of a real company. Major cybersecurity companies are starting to develop this area, and one can observe such cyber exercises in a gaming format at events like Positive Hack Days. <\/p>\n

A typical network infrastructure scheme of a large enterprise or corporation includes a standard set of servers, workstations, and various network devices with a standard suite of corporate software and information security systems. An industry-specific cyber polygon includes all of the above, plus significant specifications that greatly complicate the virtual model. <\/p>\n

How we brought the cyber polygon closer to reality <\/h3>\n

\nConceptually, the appearance of the industrial part of the cyber polygon depends on the chosen method of modeling a complex cyber-physical system. There are three main approaches to modeling: <\/p>\n

\"How
\n
\nEach of these approaches has its advantages and disadvantages. Depending on the ultimate goal and existing constraints, all three of the aforementioned methods can be applied in different cases. To formalize the selection of these methods, we have developed the following algorithm: <\/p>\n

\"How
\n
\nThe advantages and disadvantages of different modeling methods can be represented in a diagram, where the y-axis represents the coverage of research areas (i.e., the flexibility of the proposed modeling tool), and the x-axis represents the accuracy of the modeling (the degree of correspondence to the real system). This essentially forms a Gartner square:<\/p>\n

\"How
\n
\nThus, the optimal balance of modeling accuracy and flexibility is achieved through so-called Hardware-in-the-Loop (HIL) modeling. In this approach, the cyber-physical system is partially simulated using real hardware and partially by mathematical models. For example, an electrical substation can be represented by actual microprocessor devices (relay protection terminals), automated control system servers, and other secondary equipment, while the physical processes occurring in the electrical grid can be implemented through a computer model. Okay, we\u2019ve settled on the modeling method. After that, it was necessary to develop the architecture of the cyber polygon. For the cyber exercises to be truly useful, all the interconnections of the real complex cyber-physical system must be recreated as accurately as possible on the polygon. Therefore, our cyber polygon, like real life, consists of several interacting levels. I remind you that the typical infrastructure of industrial networks includes the very bottom level, known as the 'primary equipment' \u2014 this could be fiber optics, an electrical network, or something else, depending on the industry. It exchanges data and is controlled by specialized industrial controllers, which are in turn managed by SCADA systems. <\/p>\n

We began creating the industrial part of the cyber polygon with the energy segment, which is currently our priority (future plans include the oil and gas and chemical industries).<\/p>\n

It is evident that the level of primary equipment cannot be realized through physical modeling using real objects. Therefore, at the first stage, we developed a mathematical model of the energy facility and the adjacent part of the power system. This model includes all the power equipment of substations \u2013 transmission lines, transformers, and so on, and is implemented in a special software package called RSCAD. The model created in this way can be processed by a real-time computing complex \u2013 its main feature is that the time of processes in the real system and in the model are absolutely identical \u2013 meaning that if a short circuit in the real network lasts for two seconds, it will be modeled in RSCAD for exactly the same amount of time. We obtain a 'live' section of the power system that operates according to all laws of physics and even reacts to external influences (for example, the triggering of relay protection and automation terminals, the disconnection of circuit breakers, etc.). Interaction with external devices has been achieved through specialized configurable communication interfaces that allow the mathematical model to interact with the controller level and the level of automated systems.<\/p>\n

The controller levels and automated control systems of the energy facility can already be created using real industrial equipment (although, if necessary, we can also use virtual models). At these two levels, there are, respectively, controllers and automation means (relay protection and automation, PMU, automated control systems, meters) and automated control systems (SCADA, OIK, AIIISKU). Physical modeling significantly enhances the realism of the model and, consequently, the cyber exercises themselves, as the teams will interact with real industrial equipment that has its own characteristics, bugs, and vulnerabilities. <\/p>\n

At the third stage, we implemented the interaction between the mathematical and physical parts of the model using specialized hardware and software interfaces and signal amplifiers. <\/p>\n

As a result, the infrastructure looks approximately like this:<\/p>\n

\"How
\n
\nAll equipment on the polygon interacts with each other just like in a real cyber-physical system. To be more specific, we used the following equipment and computing resources to build this model: <\/p>\n